Create Export

POSThttps://api.confident-ai.com/v2/organization/audit-logs/exports

Starts an export of your organization's audit logs — every audited action across every project — as a gzipped CSV, and returns the export to poll.

Send an empty body ({}) to export every audit log ever recorded. Send startTime and endTime together to export a single period instead: both ends are inclusive, endTime must be after startTime, and an audit log export has no cap on how long that period may be. searchTerm narrows it further. The startTime and endTime on the returned export are the period its file will cover — for an all-time export, the timestamps of the oldest and newest audit log matched.

The export runs in the background, so this responds 202 with status: IN_PROGRESS as soon as the job is queued. Poll GET /v2/organization/audit-logs/exports/{exportId} until status is COMPLETED; there is nothing to fetch before then. Then call GET /v2/organization/audit-logs/exports/{exportId}/download, which responds 302 with a Location header pointing at a pre-signed object storage URL valid for 15 minutes — follow the redirect to receive the file, and call the endpoint again rather than storing that URL. ERRORED is terminal: read errorMessage and start a new export rather than polling on.

One audit log export runs at a time per organization and caller, so starting a second while one is IN_PROGRESS returns 409. A period matching no audit logs, or matching more than 10,000,000 audit logs, is rejected with 400 — narrow it with searchTerm or a shorter period.

POST/v2/organization/audit-logs/exports

curl -X POST "https://api.confident-ai.com/v2/organization/audit-logs/exports" \
  -H "CONFIDENT_API_KEY: <ORGANIZATION-API-KEY>" \
  -H "Content-Type: application/json" \
  -d '{
  "startTime": "2025-01-01T00:00:00.000Z",
  "endTime": "2025-04-01T00:00:00.000Z",
  "searchTerm": "jane@acme.com"
}'

202

{
  "success": true,
  "data": {
    "id": "<AUDIT-LOG-EXPORT-ID>",
    "projectId": null,
    "organizationId": "<ORGANIZATION-ID>",
    "userId": "api",
    "status": "IN_PROGRESS",
    "exportType": "AUDIT_LOGS",
    "startTime": "2025-01-01T00:00:00.000Z",
    "endTime": "2025-04-01T00:00:00.000Z",
    "rowCount": 18432,
    "errorMessage": null,
    "createdAt": "2025-04-02T09:15:00.000Z",
    "completedAt": "2025-04-02T09:17:42.000Z"
  },
  "deprecated": false
}

Headers

CONFIDENT_API_KEYstringRequired
The organization API key for your Confident AI organization.

Request body

startTimestring
Start of the period to export, inclusive, as an ISO 8601 timestamp. Omit along with endTime to export all time.
endTimestring
End of the period to export, inclusive, as an ISO 8601 timestamp. Must be after startTime. Omit along with startTime to export all time.
searchTermstring
Only export audit logs matching this term. Matched as a substring against the actor email, API key name, API key id, actor type, action, HTTP method, IP address, resource id, user agent, and status code.

Response

Create Export succeeded.

successboolean
Indicates if the request was successful.
dataobject
One run of an audit log export: the period it covers, where it is in its lifecycle, and how many audit logs its file holds once it completes.
Show 12 propertiesHide 12 properties
- idstring
  The id of the export, a UUID generated by Confident AI. Poll and download the export by this id.
- projectIdstring | null
  The project whose audit logs the export covers, or null for an organization-wide export covering every project.
- organizationIdstring
  The organization the export belongs to.
- userIdstring
  The actor that started the export. api for an export started with an organization API key, or the user's id when started through an MCP OAuth session. An export is only visible to the actor that started it.
- statusenum
  Where an export is in its lifecycle. It is created IN_PROGRESS, becomes COMPLETED once its file is written to storage, and becomes ERRORED if the run failed. Only a COMPLETED export has a file to download, and both COMPLETED and ERRORED are terminal.
  Show 3 enum valuesHide 3 enum values
  - IN_PROGRESS
  - COMPLETED
  - ERRORED
- exportTypeenum
  The kind of data the file contains. Always AUDIT_LOGS for an export started at an audit log export endpoint.
  Show 5 enum valuesHide 5 enum values
  - TRACES
  - TRACES_WITH_SPANS
  - CONVERSATIONS
  - CONVERSATION_METRICS
  - AUDIT_LOGS
- startTimestring | null
  Start of the period the export covers, inclusive. For an all-time export this is the timestamp of the oldest audit log matched.
- endTimestring | null
  End of the period the export covers, inclusive. For an all-time export this is the timestamp of the newest audit log matched.
- rowCountinteger | null
  How many audit logs were written to the file. Null until the export completes.
- errorMessagestring | null
  Why the export failed, when status is ERRORED. Null otherwise.
- createdAtstring
  When the export was started.
- completedAtstring | null
  When the export finished or failed. Null while it is still running.
deprecatedboolean
Indicates if this endpoint is deprecated.

Built byConfident AI